Security Digest · Critical advisory (no CVE assigned)
GHSA-2gw2-qgjg-xh6p: Namada-apps allows Post-Genesis Validator Bypass
Impact Ledger crash. A user is able to initialize a post-genesis validator with a negative commission rate using the --force flag.
GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
cargo audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| crates.io (Rust) | namada-apps | = 1.0.0 | 1.1.0 |
Details
Impact
Ledger crash. A user is able to initialize a post-genesis validator with a negative commission rate using the --force flag. If this validator gets into the consensus set, then when computing PoS inflation inside fn updaterewardsproductsandmintinflation, an instance of mulfloor will cause the return of an Err, which causes finalizeblock to error.
Patches
This issue has been patched in apps version 1.1.0. The PoS validity predicate now enforces that the commission rate is not negative and any transaction that fails the check will be rejected, both for newly initialized validators and for commission rate change of an existing validator.
Workarounds
There are no workarounds and users are advised to upgrade.
Sources and references
- GitHub Advisory GHSA-2gw2-qgjg-xh6p github.com
- github.com github.com
Critical crates.io (Rust) advisories · Today’s Security Digest